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Claims 



[cl ] 1 . A data processing system-implemented method of tracking movement 

between network addresses comprising: 

receiving a first frame identifier and a first network address at a first time; 
finding a record including the first frame identifier, a second network 
address, and a second time, wherein the second time precedes the first time; 
and 

generating an entry for a table that includes the first frame identifier, the 
first network address, the second network address, and a third time. 

[c2] 2. The method of claim 1 , wherein the first time and the third time are 

substantially a same time. 

[c3] 3. The method of claim 1 , further comprising sending a view to a user before 

receiving the first frame and the first network address, wherein the view 
includes the first frame and a second frame having a second frame identifier. 

[c4] 4. The method of claim 3, further comprising generating a node diagram 

illustrating a sequence of network addresses that originated from the first 
frame but not the second frame. 

[c5] 5, The method of claim 1 , further comprising, in response to receiving, 

sending a view corresponding to the first network address to a computer 
that requested the first network address. 



[c6] 



6. The method of claim 1 , further comprising generating a statement of 
activity, wherein: 

the first network address is significantly owned or controlled by a first party; 
the second network address is significantly owned or controlled by a second 
party; 

the first party is not significantly owned or controlled by the second party, 
and the second party is not significantly owned or controlled by the first 
party; and 

the statement indicates that a user activated the second network address 
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from the first network address. 

7. The method of claim 1 , wherein: 

receiving further comprises receiving a user identifier; and 

the second time is closest in time to the first time for the user identifier and 

frame identifier. 

8. A data processing system-implemented method of tracking movement 
between network addresses comprising: 

displaying a first view to a user, wherein the first view includes a first frame 
having a first frame identifier and a second frame having a second frame 
identifier; 

receiving a first request for a first network address from the user, wherein 
the first request is generated by the user activating a first object within the 
first frame; 

sending the first frame identifier and the first network address at a first time; 
finding a record including the first frame identifier, a second network 
address, and a second time, wherein, for the first frame identifier, the 
second time precedes the first time; and 

generating a first entry for a table that includes the first frame identifier, the 
first network address, the second network address, and a third time. 

9. The method of claim 8, wherein the first time and the third time are 
substantially a same time. 

10. The method of claim 8, further comprising displaying a second view 
corresponding to the first network address to the user. 

1 1. The method of claim 8, wherein the second time is closest in time to the 
first time for the first frame identifier. 

1 2. The method of claim 8, further comprising: 

receiving a second request for a third network address from the user, 
wherein the second request is generated by the user activating a second 
object within the second frame; 
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sending the second frame identifier and the third network address at a 
fourth time; 

finding a record having the second frame identifier, a fourth network 
address, and a fifth time, wherein, for the second frame identifier, the fifth 
time precedes and is closest in time to the fourth time; and 
generating a second entry for the table that includes the second frame 
identifier, the third network address, the fourth network address, and a sixth 
time. 

13. A data processing system readable medium having code embodied 
therein, the code including instructions executable by a data processing 
system, wherein the instructions are configured to cause the data processing 
system to perform a method of tracking movement between network 
addresses, the method comprising: 

receiving a first frame identifier and a first network address at a first time; 
finding a record including the first frame identifier, a second network 
address, and a second time, wherein the second time precedes the first time; 
and 

generating an entry for a table that includes the first frame identifier, the 
first network address, the second network address, and a third time. 

1 4. The data processing system readable medium of claim 1 3, wherein the 
first time and the third time are substantially a same time. 

1 5. The data processing system readable medium of claim 1 3, wherein the 
method further comprises sending a view to a user before receiving the first 
frame and the first network address, wherein the view includes the first 
frame and a second frame having a second frame identifier. 

1 6. The data processing system readable medium of claim 1 5, wherein the 
method further comprises generating a node diagram illustrating a sequence 
of network addresses that originated from the first frame but not the second 
frame. 
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[cl 7] 1 7. The data processing system readable medium of claim 13, wherein the 

method further comprises, in response to receiving, sending a view 
corresponding to the first network address to a computer that requested the 
first network address. 

[cl 8] 1 8. The data processing system readable medium of claim 13, wherein the 

method further comprises generating a statement of activity, wherein: 
the first network address is significantly owned or controlled by a first party; 
the second network address is significantly owned or controlled by a second 
party; 

the first party is not significantly owned or controlled by the second party, 
and the second party is not significantly owned or controlled by the first 
party; and 



u 

P the statement indicates that a user activated the second network address 



from the first network address. 
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fJl [cl 9] 1 9. The data processing system readable medium of claim 1 3, wherein: 

i!3 

, receiving further comprises receiving a user identifier; and 

:-i the second time is closest in time to the first time for the user identifier and 

frame identifier. 



20. A data processing system readable medium having code embodied 
therein, the code including instructions executable by a data processing 
system, wherein the instructions are configured to cause the data processing 
system to perform a method of tracking movement between network 
addresses, the method comprising: 

displaying a first view to a user, wherein the first view includes a first frame 
having a first frame identifier and a second frame having a second frame 
identifier; 

receiving a first request for a first network address from the user, wherein 
the first request is generated by the user activating a first object within the 
first frame; 

sending the first frame identifier and the first network address at a first time; 
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finding a record including the first frame identifier, a second network 
address, and a second time, wherein, for the first frame identifier, the 
second time precedes the first time; and 

generating a first entry for a table that includes the first frame identifier, the 
first network address, the second network address, and a third time. 

21 . The data processing system readable medium of claim 20, wherein the 
first time and the third time are substantially a same time. 

22. The data processing system readable medium of claim 20, further 
comprising displaying a second view corresponding to the first network 
address to the user. 

23. The data processing system readable medium of claim 20, wherein the 
second time is closest in time to the first time for the first frame identifier. 

24. The data processing system readable medium of claim 20, further 
comprising: 

receiving a second request for a third network address from the user, 
wherein the second request is generated by the user activating a second 
object within the second frame; 

sending the second frame identifier and the third network address at a 
fourth time; 

finding a record having the second frame identifier, a fourth network 
address, and a fifth time, wherein, for the second frame identifier, the fifth 
time precedes and is closest in time to the fourth time; and 
generating a second entry for the table that includes the second frame 
identifier, the third network address, the fourth network address, and a sixth 
time. 
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